TLS certificate SAN or hostname mismatch

dig +short A example.com
dig +short CNAME app.example.com
# confirm both names resolve to the endpoint you expect before touching any certificate

openssl s_client -connect example.com:443 -servername app.example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -text | grep -A1 'Subject Alternative Name'

# equivalent one liner
echo | openssl s_client -connect example.com:443 -servername app.example.com 2>/dev/null \
  | openssl x509 -noout -ext subjectAltName

# bad result: only DNS:www.example.com, DNS:example.com printed, app.example.com missing
# nmap alternative
nmap --script ssl-cert -p 443 example.com

# Let's Encrypt / certbot: list every existing SAN plus the new one
certbot certonly --expand --cert-name example.com \
  -d example.com -d www.example.com -d app.example.com

# --expand keeps the previously issued SANs automatically if you forget one

# Order an Advanced Certificate with the full hosts array, including the missing name
curl -s -X POST "https://api.cloudflare.com/client/v4/zones/ZONE_ID/ssl/certificate_packs" \
  -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "type": "advanced",
    "hosts": ["example.com", "www.example.com", "app.example.com"],
    "validation_method": "txt",
    "validity_days": 90,
    "certificate_authority": "lets_encrypt"
  }'

# poll status until it reports active
curl -s "https://api.cloudflare.com/client/v4/zones/ZONE_ID/ssl/certificate_packs/CERT_PACK_ID" \
  -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

echo | openssl s_client -connect example.com:443 -servername app.example.com 2>/dev/null \
  | openssl x509 -noout -ext subjectAltName
# good result: DNS:app.example.com now present alongside the other names

curl -vI https://app.example.com 2>&1 | grep -i 'subject\|issuer\|SSL certificate problem'
# good result: subject/issuer print normally, no 'SSL certificate problem' line,
# no certificate verify failed or hostname mismatch error, headers return normally

"""Detect a TLS certificate SAN/hostname mismatch and optionally repair it via Cloudflare.
Safe by default. Set DRY_RUN=false to let it write.
"""
import os
import logging

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("tls_san_hostname_mismatch")

DNS_DOMAIN = os.environ.get("DNS_DOMAIN", "example.com")
CLOUDFLARE_API_TOKEN = os.environ.get("CLOUDFLARE_API_TOKEN", "")
CLOUDFLARE_ZONE_ID = os.environ.get("CLOUDFLARE_ZONE_ID", "")
CLOUDFLARE_CERT_PACK_ID = os.environ.get("CLOUDFLARE_CERT_PACK_ID", "")
DRY_RUN = os.environ.get("DRY_RUN", "true").lower() == "true"

CF_API = "https://api.cloudflare.com/client/v4"


def san_covers_hostname(hostname: str, san_dns_names: list) -> bool:
    """Pure decision function. No I/O.

    Given the requested hostname and the list of dNSName strings pulled from
    the certificate's SAN extension, normalize case, then return True if the
    hostname is an exact match to any entry or matches a leftmost-label
    wildcard entry (e.g. '*.example.com' matches 'app.example.com' but not
    'a.b.example.com' or the bare apex 'example.com'). Returns False otherwise.
    """
    host = hostname.strip().lower().rstrip(".")
    names = [n.strip().lower().rstrip(".") for n in san_dns_names]

    if host in names:
        return True

    host_labels = host.split(".")
    for name in names:
        if not name.startswith("*."):
            continue
        wildcard_suffix = name[2:]
        # Wildcard covers exactly one leftmost label: 'app.example.com' but not
        # 'a.b.example.com', and never the bare suffix itself ('example.com').
        if len(host_labels) < 3:
            continue
        remainder = ".".join(host_labels[1:])
        if remainder == wildcard_suffix:
            return True
    return False


def fetch_san_for_hostname(hostname, port=443):
    """Open a TLS connection with SNI set to hostname and return its SAN dNSNames. Requires network."""
    import socket
    import ssl

    ctx = ssl.create_default_context()
    with socket.create_connection((hostname, port), timeout=10) as sock:
        with ctx.wrap_socket(sock, server_hostname=hostname) as tls:
            cert = tls.getpeercert()
    names = [value for key, value in cert.get("subjectAltName", ()) if key == "DNS"]
    return names


def get_cert_pack_hosts():
    """Read the current hosts array off a Cloudflare Advanced Certificate pack."""
    import requests

    headers = {"Authorization": f"Bearer {CLOUDFLARE_API_TOKEN}"}
    url = f"{CF_API}/zones/{CLOUDFLARE_ZONE_ID}/ssl/certificate_packs/{CLOUDFLARE_CERT_PACK_ID}"
    r = requests.get(url, headers=headers, timeout=30)
    r.raise_for_status()
    return r.json()["result"].get("hosts", [])


def add_hostname_to_cert_pack(hostname):
    """Add the missing hostname as a SAN by patching the Cloudflare certificate pack."""
    import requests

    if DRY_RUN:
        log.info("[dry run] would add %s to certificate pack %s", hostname, CLOUDFLARE_CERT_PACK_ID)
        return

    headers = {"Authorization": f"Bearer {CLOUDFLARE_API_TOKEN}", "Content-Type": "application/json"}
    url = f"{CF_API}/zones/{CLOUDFLARE_ZONE_ID}/ssl/certificate_packs/{CLOUDFLARE_CERT_PACK_ID}"
    hosts = get_cert_pack_hosts()
    if hostname not in hosts:
        hosts = hosts + [hostname]
    requests.patch(url, headers=headers, json={"hosts": hosts}, timeout=30).raise_for_status()
    log.info("Requested certificate pack update to include %s", hostname)


def run():
    hostname = DNS_DOMAIN
    san_names = fetch_san_for_hostname(hostname)
    log.info("SAN entries served for %s: %s", hostname, san_names)

    if san_covers_hostname(hostname, san_names):
        log.info("Nothing to repair. %s is already covered.", hostname)
        return

    log.warning("Hostname %s is missing from the served certificate's SAN list.", hostname)

    if not (CLOUDFLARE_API_TOKEN and CLOUDFLARE_ZONE_ID and CLOUDFLARE_CERT_PACK_ID):
        log.warning("Mismatch found but no Cloudflare certificate pack credentials set. Skipping repair.")
        return

    add_hostname_to_cert_pack(hostname)


if __name__ == "__main__":
    run()

/**
 * Detect a TLS certificate SAN/hostname mismatch and optionally repair it via Cloudflare.
 * Safe by default. Set DRY_RUN=false to let it write.
 */
import { pathToFileURL } from "node:url";

const DNS_DOMAIN = process.env.DNS_DOMAIN || "example.com";
const CLOUDFLARE_API_TOKEN = process.env.CLOUDFLARE_API_TOKEN || "";
const CLOUDFLARE_ZONE_ID = process.env.CLOUDFLARE_ZONE_ID || "";
const CLOUDFLARE_CERT_PACK_ID = process.env.CLOUDFLARE_CERT_PACK_ID || "";
const DRY_RUN = (process.env.DRY_RUN || "true").toLowerCase() === "true";
const CF_API = "https://api.cloudflare.com/client/v4";

/**
 * Pure decision function. No I/O.
 *
 * Given the requested hostname and the list of dNSName strings pulled from
 * the certificate's SAN extension, normalize case, then return true if the
 * hostname is an exact match to any entry or matches a leftmost-label
 * wildcard entry (e.g. '*.example.com' matches 'app.example.com' but not
 * 'a.b.example.com' or the bare apex 'example.com'). Returns false otherwise.
 */
export function sanCoversHostname(hostname, sanDnsNames) {
  const host = hostname.trim().toLowerCase().replace(/\.$/, "");
  const names = sanDnsNames.map((n) => n.trim().toLowerCase().replace(/\.$/, ""));

  if (names.includes(host)) return true;

  const hostLabels = host.split(".");
  for (const name of names) {
    if (!name.startsWith("*.")) continue;
    const wildcardSuffix = name.slice(2);
    // Wildcard covers exactly one leftmost label: 'app.example.com' but not
    // 'a.b.example.com', and never the bare suffix itself ('example.com').
    if (hostLabels.length < 3) continue;
    const remainder = hostLabels.slice(1).join(".");
    if (remainder === wildcardSuffix) return true;
  }
  return false;
}

/** Open a TLS connection with SNI set to hostname and return its SAN dNSNames. Requires network. */
async function fetchSanForHostname(hostname, port = 443) {
  const tls = await import("node:tls");
  return new Promise((resolve, reject) => {
    const socket = tls.connect({ host: hostname, port, servername: hostname, timeout: 10000 }, () => {
      const cert = socket.getPeerCertificate();
      const raw = cert.subjectaltname || "";
      const names = raw
        .split(", ")
        .filter((entry) => entry.startsWith("DNS:"))
        .map((entry) => entry.slice(4));
      socket.end();
      resolve(names);
    });
    socket.on("error", reject);
    socket.on("timeout", () => {
      socket.destroy();
      reject(new Error(`TLS connection to ${hostname}:${port} timed out`));
    });
  });
}

/** Read the current hosts array off a Cloudflare Advanced Certificate pack. */
async function getCertPackHosts() {
  const url = `${CF_API}/zones/${CLOUDFLARE_ZONE_ID}/ssl/certificate_packs/${CLOUDFLARE_CERT_PACK_ID}`;
  const res = await fetch(url, { headers: { Authorization: `Bearer ${CLOUDFLARE_API_TOKEN}` } });
  if (!res.ok) throw new Error(`Cloudflare cert pack read failed: ${res.status}`);
  const body = await res.json();
  return body.result.hosts || [];
}

/** Add the missing hostname as a SAN by patching the Cloudflare certificate pack. */
async function addHostnameToCertPack(hostname) {
  if (DRY_RUN) {
    console.log(`[dry run] would add ${hostname} to certificate pack ${CLOUDFLARE_CERT_PACK_ID}`);
    return;
  }

  const hosts = await getCertPackHosts();
  const nextHosts = hosts.includes(hostname) ? hosts : [...hosts, hostname];
  const url = `${CF_API}/zones/${CLOUDFLARE_ZONE_ID}/ssl/certificate_packs/${CLOUDFLARE_CERT_PACK_ID}`;
  const res = await fetch(url, {
    method: "PATCH",
    headers: {
      Authorization: `Bearer ${CLOUDFLARE_API_TOKEN}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ hosts: nextHosts }),
  });
  if (!res.ok) throw new Error(`Cloudflare cert pack update failed: ${res.status}`);
  console.log(`Requested certificate pack update to include ${hostname}`);
}

async function run() {
  const hostname = DNS_DOMAIN;
  const sanNames = await fetchSanForHostname(hostname);
  console.log(`SAN entries served for ${hostname}: ${sanNames.join(", ")}`);

  if (sanCoversHostname(hostname, sanNames)) {
    console.log(`Nothing to repair. ${hostname} is already covered.`);
    return;
  }

  console.warn(`Hostname ${hostname} is missing from the served certificate's SAN list.`);

  if (!(CLOUDFLARE_API_TOKEN && CLOUDFLARE_ZONE_ID && CLOUDFLARE_CERT_PACK_ID)) {
    console.warn("Mismatch found but no Cloudflare certificate pack credentials set. Skipping repair.");
    return;
  }

  await addHostnameToCertPack(hostname);
}

if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
  run().catch((err) => {
    console.error(err);
    process.exit(1);
  });
}

from tls_san_hostname_mismatch import san_covers_hostname


def test_exact_match():
    assert san_covers_hostname("example.com", ["example.com", "www.example.com"]) is True


def test_case_insensitive_exact_match():
    assert san_covers_hostname("APP.example.com", ["app.example.com"]) is True


def test_missing_hostname_returns_false():
    assert san_covers_hostname("app.example.com", ["example.com", "www.example.com"]) is False


def test_wildcard_matches_one_label_subdomain():
    assert san_covers_hostname("app.example.com", ["*.example.com"]) is True


def test_wildcard_does_not_match_two_label_subdomain():
    assert san_covers_hostname("a.b.example.com", ["*.example.com"]) is False


def test_wildcard_does_not_match_bare_apex():
    assert san_covers_hostname("example.com", ["*.example.com"]) is False

import { test } from "node:test";
import assert from "node:assert/strict";
import { sanCoversHostname } from "./tls-san-hostname-mismatch.js";

test("exact match", () => {
  assert.equal(sanCoversHostname("example.com", ["example.com", "www.example.com"]), true);
});

test("case insensitive exact match", () => {
  assert.equal(sanCoversHostname("APP.example.com", ["app.example.com"]), true);
});

test("missing hostname returns false", () => {
  assert.equal(sanCoversHostname("app.example.com", ["example.com", "www.example.com"]), false);
});

test("wildcard matches one label subdomain", () => {
  assert.equal(sanCoversHostname("app.example.com", ["*.example.com"]), true);
});

test("wildcard does not match two label subdomain", () => {
  assert.equal(sanCoversHostname("a.b.example.com", ["*.example.com"]), false);
});

test("wildcard does not match bare apex", () => {
  assert.equal(sanCoversHostname("example.com", ["*.example.com"]), false);
});